This vulnerability (CVE-2026-66446) is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') affecting If-So Dynamic Content Personalization plugin versions up to 1.10. The flaw allows remote attackers to inject SQL commands without authentication, resulting in a critical impact on confidentiality and a low impact on availability. The CVSS v3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and scope change. No vendor advisory or patch information is currently available.

Successful exploitation could lead to unauthorized disclosure of sensitive data due to SQL Injection. The integrity impact is not indicated, and availability impact is low. The vulnerability can be exploited remotely without authentication or user interaction, increasing its risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting this plugin. Monitor for updates from the vendor regarding official patches or mitigations.